I-Solution Rendszerintegrációs Korlátolt Felelősségű Társaság (registered office: 8200 Veszprém, Csererdei utca 23.; company registration number: 19-09-518232; tax number: 24161501-2-19; represented by its managing director, Mrs Tiborné Czermann; acting as data controller, hereinafter referred to as the “Data Controller” or “I-Solution Rendszerintegrációs Kft.”) considers the protection and lawful processing of the personal data of its business partners and customers, as well as users of the test.i-solution.hu/ website (hereinafter collectively referred to as the “Customer”), to be of utmost importance.

In the course of its business operations, I-Solution Rendszerintegrációs Kft. pays particular attention to compliance with both Hungarian and international legislation and other requirements. It seeks to ensure, through the necessary access-control measures and internal organisational and technical solutions implemented in its operations and IT systems, that personal data do not come into the possession of unauthorised persons and that unauthorised persons cannot delete, extract from the system or modify such data.

This Privacy Notice provides information about the processing of personal data and data-processing activities carried out in connection with the legal relationships established between I-Solution Rendszerintegrációs Kft. and its Customers.

Contact details

• Data Controller: I-Solution Rendszerintegrációs Kft.
• Registered office: 8200 Veszprém, Csererdei utca 23.
• Telephone: +36-1-347-5080, +36 30 942-0242
• Email: iroda@I-Solution.hu
• Hosting provider: Jimdo GmbH, Stresemannstraße 375, 22761 Hamburg, Germany.

1. Categories of data processed, purposes and legal bases of processing, and data retention period

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “GDPR”), I-Solution Rendszerintegrációs Kft. processes the personal data provided by Customers on the following legal bases and for the following purposes:

Processing of data when using services or placing orders

Purpose of processing
Fulfilment of statutory and contractual obligations in the course of performing the contract.

Categories of data processed
The following Customer data:

• Name and company name;
• Contact details (name, job title, email address, telephone number);
• Delivery details (address, quantity, contact details);
• Billing details (tax number, bank account number, name of bank, invoice or document number).

Legal basis for processing
For the processing necessary to perform contractual obligations, the legal basis is Article 6(1)(b) of the GDPR.
For billing data, processing is based on Article 6(1)(c) of the GDPR, as necessary to comply with a legal obligation.

Data retention period
We process the data until the contractual relationship has ended.
The data are retained for the period specified in Sections 166(1) and 169(1) of Act C of 2000 on Accounting (8 years).

2. Data transfers and data processor(s)

I-Solution Rendszerintegrációs Kft. declares that it does not transfer the personal data provided by the Customer to any other person. If such a transfer becomes necessary, the data may be transferred only after the Customer has been informed in advance and has given consent.

An exception applies to data transfers made in response to an official request from a public authority or court. I-Solution Rendszerintegrációs Kft. maintains a register of data transfers.

3. Customer rights relating to data processing

You are entitled to the rights listed below, which you may exercise by submitting a request form addressed to I-Solution Rendszerintegrációs Kft. or by contacting us by email.

During the data-processing period, Customers have the following rights under the GDPR:

• the right of access to personal data and to information about the processing;
• the right to rectification;
• the right to restriction of processing;
• the right to erasure;
• the right to data portability;
• the right to object;
• the right to withdraw consent.

We can fulfil your request only after we have verified your identity. For this purpose, you may need to provide personal data; however, identification may be based only on data that we already process about you. Your complaint or request relating to data processing must also be available in our email account within the time limit specified in this Notice for handling complaints and requests.

We will respond to complaints and requests relating to data processing within 30 (thirty) days at the latest.

3.1. Right of access to personal data and information

You have the right to obtain confirmation as to whether or not your personal data are being processed. Where they are being processed, you have the right to access those personal data and to receive information about:

• the purpose(s) of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed;
• the envisaged period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period;
• your right to request rectification or erasure of personal data or restriction of processing, and to object to processing of such personal data where it is based on legitimate interests;
• the right to lodge a complaint with the supervisory authority;
• where the personal data have not been collected from you, any available information about their source;
• the existence of automated decision-making, including profiling, where applicable, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you.

As the exercise of this right may be intended to establish and verify the lawfulness of processing, we may charge a fee for responding to a request, or refuse to act on it, if the request is manifestly unfounded or excessive, including where requests for information are repeated.

After verifying your identity, we will provide access to your personal data and the relevant information by email within 30 (thirty) days of receiving your request.

Please clearly specify in your request whether you are seeking access to your personal data or information about the processing, so that we can fulfil your request within the applicable deadline.

3.2. Right to rectification

You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay.

3.3. Right to restriction of processing

You have the right to request restriction of the processing of your personal data in the following circumstances:

• Inaccurate personal data: restriction applies for the period necessary to allow us to verify the accuracy of the personal data. If verification is not necessary, restriction will not be applied;
• Unlawful processing: you oppose the erasure of the data and request restriction of their use instead;
• The purpose of processing has ceased: you require the data for the establishment, exercise or defence of legal claims; or
• You have objected to processing, but our legitimate interests provide a basis for it: processing must be restricted until it has been determined whether our legitimate grounds override your grounds.

Where processing is restricted, the personal data may, apart from storage, be processed only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

We will inform you in advance when the restriction of processing is lifted, at least 3 working days before the restriction is lifted.

3.4. Right to erasure (“right to be forgotten”)

You have the right to obtain the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to processing based on legitimate interests and there are no overriding legitimate grounds for the processing;
• the personal data have been processed unlawfully, as established following a complaint;
• the personal data must be erased to comply with a legal obligation under applicable EU or Member State law.

Where we have made personal data concerning you public on a lawful basis and are required to erase them for any of the reasons listed above, we will take reasonable steps, including technical measures, taking account of available technology and the cost of implementation, to inform other data controllers processing the data that you have requested the erasure of links to, or copies or replications of, those personal data. As a general rule, we do not make your personal data public.

The right to erasure does not apply where processing is necessary:

• for exercising the right to freedom of expression and information;
• for compliance with a legal obligation under applicable EU or Member State law that requires processing of personal data (for example, processing for invoicing purposes, since legislation requires invoices to be retained), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for the establishment, exercise or defence of legal claims (for example, where you have an outstanding debt to us or a consumer or data-protection complaint is being handled).

3.5. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where the processing is based on legitimate interests. In such cases, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

3.6. Right to data portability

Where processing is necessary for the performance of a contract or is based on your voluntary consent, you have the right to request that the data you have provided to us be made available to you in a machine-readable format. We will provide the data in XML, JSON or CSV format. Where technically feasible, you may request that we transmit the data in this format to another data controller.

3.7. Right to withdraw consent

You may withdraw your consent to data processing at any time. In such cases, we will delete the personal data you provided from our systems.

4. Legal remedies

You have the right to lodge a complaint with I-Solution Rendszerintegrációs Kft. concerning the processing of your personal data where I-Solution Rendszerintegrációs Kft. processes your personal data solely to fulfil its own legal obligations or on the basis of the legitimate interests of a third party.

If you believe that I-Solution Rendszerintegrációs Kft. is processing your data unlawfully, has breached statutory provisions governing data processing, or has failed to fulfil your request, you may lodge a complaint with the following supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
• Postal address: 1530 Budapest, P.O. Box 5, Hungary
• Email: ugyfelszolgalat@naih.hu

You may also enforce your rights before a court pursuant to Act V of 2013 on the Civil Code.

5. Data security

In the course of its operations and the operation of its IT systems, I-Solution Rendszerintegrációs Kft. implements the necessary access-control measures and internal organisational and technical solutions. We also ensure that our data processors comply with data-protection and data-security requirements.

We maintain a register of any personal data breaches and, where necessary, inform Customers affected by breaches that present a high risk.

6. Miscellaneous provisions

I-Solution Rendszerintegrációs Kft. reserves the right to amend this Privacy Notice unilaterally.

This Privacy Notice enters into force on 1 August 2022.